Section 4 - Automation Systems
Section 4
Automation Systems
A. Machinery Alarm Systems
1. The machinery alarm system shall provide a
visual and an audible signal of unacceptable deviations
from operating figures, see Section 8, B.
2. Alarm delays shall be kept within time limits to
prevent any risk to the monitored system in the event of
exceeding the limit value.
3. Visual signals shall be individually indicated at a
central position. The meaning of the individual indications
must be clearly identifiable by text or symbols.
If a fault is indicated, the visual signal must remain visible
until the fault has been eliminated. It must be possible to
distinguish between a visual signal which has been
acknowledged and one that has not been acknowledged.
4. It must be possible to acknowledge audible
signals.
The acknowledgement of an alarm shall not inhibit an
alarm which has been generated by new causes.
5. Acknowledgement of visual signals shall only be
possible where the fault has been indicated as an individual
signal and a sufficient overview of the concerned process
is been given.
6. Alarms must be discernible under all operating
conditions. Where this cannot be guaranteed, for example
due to the noise level, additional visual signals, e.g.
flashing lights must be installed.
7. Transient faults which are self-correcting without
intervention shall be memorized and indicated by visual
signals which shall only disappear when the alarm has
been acknowledged.
8. The audible signal in the machinery space may be
switched off during unattended operation, if the
operational readiness of the audible signalling equipment
is ensured by appropriate measures during the remaining
time.
9. Alarms shall also be given on the bridge and in
the accommodation and mess areas of the engineer officers
4-1
or those of the crew members responsible for the
machinery plant, whenever the machinery plant is not
attended. It shall be possible to call up individually the
engineer officer or responsible crew member who is on
duty and this must be indicated on the bridge.
10. During the port operation, the alarms in the
machinery space must be signalled at least in form of a
collective alarm in the accommodation and mess areas of
the engineering officers or the crew member responsible
for the machinery plant.
11. Where an alarm has not been acknowledged
within a preset time, an alarm must be released in the
accommodation and mess areas of the engineer officers.
12. The alarms on the bridge shall be prepared in
form of collective alarms into three groups according to
their urgency.
12.1 "Stop" group: alarms signalling faults which
require the propulsion system to be shut down
immediately.
12.2 "Reduce" group: alarms signalling faults which
require a reduction in power of the propulsion system.
12.3 "Common" group: alarms signalling faults which
do not require actions as described in 12.1 or 12.2.
13. An acknowledgement of alarms shall be indicated
on the bridge.
14. Alarm systems shall be designed on the closed-
circuit or the monitored open-circuit principle.
Equivalent monitoring principles are permitted.
15. The alarm system must be supplied from the main
power source with battery backup for at least 15
minutes.
The failure of the supply from the main power source is to
be alarmed.
16. If limit values are exceeded, this is to be recorded
with date and time relating to the occurrence and the
clearing of the fault in chronological order. The beginning
and end of a fault must be clearly recognizable.
4-2 Section 4 - Automation Systems
17. Collective alarms from essential, stand-alone
systems which are signalled to the machinery alarm system
are to be recorded.
The individual alarms must be recognizable at the
concerned system.
18. The automatic suppression of alarm signals is to
be monitored for correct function or shall be of redundant
type.
19. The failure of the machinery alarm system shall
be signalled on the bridge and in the accommodation and
mess areas of the engineer officers or the responsible crew
members.
20. Machinery alarm systems are subject to
mandatory type approval.
B. Wireless Duty Alarm Systems
Where the alarms for the engineer officers or those of the
crew members responsible for the machinery plant
according to A.9 be designed as a wireless duty alarm
system, the following is to be observed:
1. The function of the system has to be proved in all
areas of the ship.
2. The minimum operation time of the mobile units
shall be at least 12 hours without intermediate charging.
An alarm shall be given in time before the automatic
switch off.
3. At least two charged reserve units shall be
available.
4. Alarms shall be set above personnel calls. Calls
to persons shall not suppress alarms.
5. The fixed stations shall be supplied at least for 15
minutes in case of a failure of the ship's mains.
6. Watch and alarm functionalities shall be realised
as in standard hardwired systems.
7. Radio contact between the fixed and mobile units
shall be checked regularly automatically. The loss of the
contact has to be alarmed.
8. Wireless duty alarm systems are subject to
mandatory type approval.
C. Safety Systems
1. Safety systems shall be independent of open and
closed loop control and alarm systems. Faults in one
system must not affect other systems.
Deviations from this requirement may be allowed for
redundant equipment with the agreement of BKI where this
would entail no risk to human life and where ship safety
would not be endangered.
2. Safety systems shall be assigned to systems which
need protection.
3. Where safety systems are provided with
overriding arrangements, these shall be safeguarded
against accidental operation. The actuation of overriding
arrangements is to be indicated and recorded.
4. The monitored open-circuit principle is to be
applied to safety systems. Alternatively, the closed circuit
principle may be applied where it is demanded by the
provisions of national regulations (e.g. boiler and oil-fired
systems).
Equivalent monitoring principles are permitted.
Faults, and also the activation of safety systems shall be
alarmed and recorded.
5. On failure of the ship's main power supply, the
power supply to a safety system must be guaranteed for at
least 15 minutes.
6. The power supply is to be monitored and loss of
power is to be indicated by an alarm and recorded.
7. Safety systems shall be designed preferably using
conventional technology (hard wired). Alternative
technical solutions shall be agreed with BKI.
8. Safety systems are subject to mandatory type
testing.
 Section 4 - Automation Systems
D. Reductions
1. When reaching dangerous limits, reductions shall
automatically adapt the operation temporary to the
remaining technical capabilities or demand this, see
Section 8, B.
The reduction may be a function of the machinery alarm
system.
2. Where reductions are provided with overriding
arrangements, these shall be safeguarded against accidental
operation. The actuation of overriding arrangements is to
be indicated.
E. Safety Devices
1. The design of safety devices shall be as simple as
possible and must be reliable and inevitable in operation.
Proven safety devices which are not depending on a power
source are to be preferred.
2. The suitability and function of safety devices
must be demonstrated in the given application.
3. Safety devices shall be so designed that potential
faults such as, for example, loss of voltage or a broken
wire shall not create a hazard to human life, ship or
machinery.
These faults and also the tripping of safety devices shall be
signalled by an alarm.
4. Where faults which affect the operation of the
devices cannot be identified, appropriate test facilities shall
be provided which shall be actuated periodically.
5. The adjustment facilities for safety devices shall
be so designed that the last setting can be detected.
6. Safety devices shall be designed preferably using
conventional technology (hard wired). Alternative
technical solutions shall be agreed with BKI.
7. Where auxiliary energy is required for the
function of safety devices, this has to be monitored and a
failure has to be alarmed.
8. Safety devices are subject to mandatory type
testing.
F. Communication Systems
4-3
Reliable voice communications, e.g. designated telephones,
battery-powered telephones or sound-powered
communication systems, shall be provided between the
machinery control room or the machinery control station,
the bridge and the accommodation and mess areas of the
engineer officers or the crew members responsible for the
machinery.
See Rules for Electrical Installations, Volume IV,
Section 9 and Section 13.
G. Fire Detection Systems for Machinery Spaces
1. For general requirements relating to fire alarm
systems, see Rules for Electrical Installations, Volume IV,
Section 9 and Section 13.
2. Fire detection systems shall signal a fire at an
early stage.
3. The fire alarm shall be visual and audible
recognized on the bridge, in the accommodation and mess
areas of the engineer officers or the crew member
responsible for the machinery plant and also in the
machinery space and it must be distinguishable from other
alarms.
4. Each detection loop shall not comprise more than
one fire subdivision or one watertight compartment or,
wherever possible, more than two superimposed decks.
Separate detection loops shall be used where facilities are
provided for the separate flooding of different machinery
spaces with gaseous fire extinguishing media (e.g. CO 2 ).
The number of detectors in each loop shall not exceed 10.
5. For requirements relating to fire detection systems
with remotely and individually identified detectors, see
Rules for Electrical Installations, Volume IV, Section 9,
D.3.2.
6. The position and number of detectors shall be
specified under consideration of machinery space
ventilation, so that all endangered areas are safely covered.
This particularly applies to areas in which boilers, thermal
oil systems, waste and sludge incinerators, generators,
switchboards, refrigeration machinery and purifiers are
installed and also in the engine casing.
7. In workshops and rooms where detectors are
liable to be actuated, e.g. by welding, they may be
temporarily ineffective.
The detectors must automatically become operative again
4-4 Section 4 - Automation Systems

after a preset time. provided for automatic start-up when carrying out
manoeuvres in the lower speed range where the output of
H. Stand-by Circuits / Automatic Controls the mechanically-driven auxiliary machines is not adequate
under these conditions.
1. General

1.1 Stand-by circuits as described in Section 8, C 1.6 An alarm must not be tripped in the case of
must automatically start stand-by units, if these are machinery installations with mechanically connected
required according to Rules for Machinery Installations, pumps, when the independent pumps start up due to normal
Volume III: operation.

– in the case of failure of units in operation 1.7 The sensors for stand-by circuits have to be
independent from other systems.
– to meet the demand of auxiliary machinery with
staggered operation.
2. Stand-by circuits for generators
1.2 Automatic controls must automatically start units
as described in Section 8, C: 2.1 For the stand-by circuits for generators, see
Rules for Electrical Installations, Volume IV,
– to maintain stored energy (e.g. compressed air) Section 4, A.3.3.

– following restoration of the power supply after
black-out, due to a failure of the ship's mains.
1.3 A reciprocal operation capability is to be provided
for similar units.
2.2 Following a black-out and restoration of the
power supply, essential auxiliary machinery must start-up
again automatically, possibly in staggered formation. See
also Section 8, C.

1.4 The automatic change-over to another unit is to be

signalled by an alarm.

1.5 Where auxiliary machinery is mechanically

driven from the propulsion system, stand-by units shall be